The EU heavily regulates this specifically in the, here infamous, "AI regulations" .

Though GDPR would also ban this probably.